dcrat | c92a6ef242d78b9083c2264519be7dcf1d104f1e391a7d36ec066a4648057077

Analysis

max time kernel
149s
max time network
151s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
03/02/2023, 07:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c92a6ef242d78b9083c2264519be7dcf1d104f1e391a7d36ec066a4648057077.exe
Size

1.3MB
MD5

d917806a612e81e90cb934fa45b7feef
SHA1

d7da2c3d176c679d9003301bd00f911a6df24299
SHA256

c92a6ef242d78b9083c2264519be7dcf1d104f1e391a7d36ec066a4648057077
SHA512

21eec40401f3bd73d7846574a2434053bae2938cae537c645cd78048924a8a515e8a914545b63728dddcef6d3803e71da342ee398845ad4fabb55a3fd62e7071
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 48 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5076	1904	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4308	1904	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4356	1904	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3372	1904	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5032	1904	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5020	1904	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4940	1904	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5064	1904	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4324	1904	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4368	1904	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2592	1904	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4312	1904	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3372	1904	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3708	1904	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5064	1904	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5020	1904	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5032	1904	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4324	1904	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4368	1904	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2592	1904	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2668	1904	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4488	1904	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4504	1904	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4648	1904	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1872	1904	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	492	1904	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	412	1904	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3116	1904	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4644	1904	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1516	1904	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4092	1904	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3960	1904	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3980	1904	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1004	1904	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1888	1904	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2900	1904	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2912	1904	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2708	1904	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3332	1904	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5088	1904	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3952	1904	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2448	1904	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2720	1904	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4708	1904	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1864	1904	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4716	1904	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4016	1904	schtasks.exe	70
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	420	1904	schtasks.exe	70

DCRat payload 6 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x000800000001ac0e-283.dat	dcrat
behavioral1/files/0x000800000001ac0e-284.dat	dcrat
behavioral1/memory/1300-285-0x0000000000A60000-0x0000000000B70000-memory.dmp	dcrat
behavioral1/files/0x000800000001ac0e-481.dat	dcrat
behavioral1/files/0x000600000001ac31-532.dat	dcrat
behavioral1/files/0x000600000001ac31-531.dat	dcrat

Executes dropped EXE 3 IoCs

pid	Process
1300	DllCommonsvc.exe
3296	DllCommonsvc.exe
940	csrss.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\5b884080fd4f94	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Mail\csrss.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Mail\886983d96e3d3e	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\dllhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\5940a34987c991	DllCommonsvc.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1612.10312.0_neutral_split.scale-125_8wekyb3d8bbwe\microsoft.system.package.metadata\dllhost.exe	DllCommonsvc.exe
File created	C:\Program Files\Common Files\microsoft shared\fontdrvhost.exe	DllCommonsvc.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\Provisioning\Cosa\OEM\smss.exe	DllCommonsvc.exe
File created	C:\Windows\Provisioning\Cosa\OEM\69ddcba757bf72	DllCommonsvc.exe
File created	C:\Windows\Web\4K\Wallpaper\Windows\explorer.exe	DllCommonsvc.exe
File opened for modification	C:\Windows\Web\4K\Wallpaper\Windows\explorer.exe	DllCommonsvc.exe
File created	C:\Windows\Web\4K\Wallpaper\Windows\7a0fd90576e088	DllCommonsvc.exe
File created	C:\Windows\diagnostics\index\services.exe	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 48 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4308	schtasks.exe
5020	schtasks.exe
492	schtasks.exe
3980	schtasks.exe
2708	schtasks.exe
4368	schtasks.exe
3332	schtasks.exe
1864	schtasks.exe
420	schtasks.exe
4716	schtasks.exe
4312	schtasks.exe
1872	schtasks.exe
3116	schtasks.exe
2900	schtasks.exe
2448	schtasks.exe
2720	schtasks.exe
4356	schtasks.exe
5032	schtasks.exe
3960	schtasks.exe
2912	schtasks.exe
4708	schtasks.exe
4324	schtasks.exe
2592	schtasks.exe
3708	schtasks.exe
5064	schtasks.exe
412	schtasks.exe
1888	schtasks.exe
4092	schtasks.exe
3952	schtasks.exe
3372	schtasks.exe
5020	schtasks.exe
4940	schtasks.exe
4504	schtasks.exe
4648	schtasks.exe
1516	schtasks.exe
4368	schtasks.exe
4324	schtasks.exe
4488	schtasks.exe
4644	schtasks.exe
1004	schtasks.exe
5088	schtasks.exe
4016	schtasks.exe
5076	schtasks.exe
5064	schtasks.exe
3372	schtasks.exe
5032	schtasks.exe
2592	schtasks.exe
2668	schtasks.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	c92a6ef242d78b9083c2264519be7dcf1d104f1e391a7d36ec066a4648057077.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	DllCommonsvc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1300	DllCommonsvc.exe
1300	DllCommonsvc.exe
1300	DllCommonsvc.exe
1300	DllCommonsvc.exe
1300	DllCommonsvc.exe
1300	DllCommonsvc.exe
1300	DllCommonsvc.exe
4680	powershell.exe
4196	powershell.exe
4556	powershell.exe
4680	powershell.exe
4484	powershell.exe
4196	powershell.exe
4520	powershell.exe
4680	powershell.exe
4196	powershell.exe
4484	powershell.exe
4556	powershell.exe
4520	powershell.exe
4484	powershell.exe
4556	powershell.exe
4520	powershell.exe
3296	DllCommonsvc.exe
3296	DllCommonsvc.exe
3296	DllCommonsvc.exe
584	powershell.exe
584	powershell.exe
4752	powershell.exe
4752	powershell.exe
2648	powershell.exe
2648	powershell.exe
3816	powershell.exe
3816	powershell.exe
4768	powershell.exe
4768	powershell.exe
2768	powershell.exe
2768	powershell.exe
4852	powershell.exe
4852	powershell.exe
1472	powershell.exe
1472	powershell.exe
584	powershell.exe
2976	powershell.exe
2976	powershell.exe
2648	powershell.exe
3732	powershell.exe
3732	powershell.exe
4752	powershell.exe
2768	powershell.exe
1284	powershell.exe
1284	powershell.exe
4864	powershell.exe
4864	powershell.exe
388	powershell.exe
388	powershell.exe
3816	powershell.exe
4852	powershell.exe
940	csrss.exe
940	csrss.exe
2648	powershell.exe
584	powershell.exe
4752	powershell.exe
2768	powershell.exe
4852	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1300	DllCommonsvc.exe
Token: SeDebugPrivilege	4680	powershell.exe
Token: SeDebugPrivilege	4196	powershell.exe
Token: SeDebugPrivilege	4556	powershell.exe
Token: SeDebugPrivilege	4484	powershell.exe
Token: SeDebugPrivilege	4520	powershell.exe
Token: SeIncreaseQuotaPrivilege	4680	powershell.exe
Token: SeSecurityPrivilege	4680	powershell.exe
Token: SeTakeOwnershipPrivilege	4680	powershell.exe
Token: SeLoadDriverPrivilege	4680	powershell.exe
Token: SeSystemProfilePrivilege	4680	powershell.exe
Token: SeSystemtimePrivilege	4680	powershell.exe
Token: SeProfSingleProcessPrivilege	4680	powershell.exe
Token: SeIncBasePriorityPrivilege	4680	powershell.exe
Token: SeCreatePagefilePrivilege	4680	powershell.exe
Token: SeBackupPrivilege	4680	powershell.exe
Token: SeRestorePrivilege	4680	powershell.exe
Token: SeShutdownPrivilege	4680	powershell.exe
Token: SeDebugPrivilege	4680	powershell.exe
Token: SeSystemEnvironmentPrivilege	4680	powershell.exe
Token: SeRemoteShutdownPrivilege	4680	powershell.exe
Token: SeUndockPrivilege	4680	powershell.exe
Token: SeManageVolumePrivilege	4680	powershell.exe
Token: 33	4680	powershell.exe
Token: 34	4680	powershell.exe
Token: 35	4680	powershell.exe
Token: 36	4680	powershell.exe
Token: SeIncreaseQuotaPrivilege	4196	powershell.exe
Token: SeSecurityPrivilege	4196	powershell.exe
Token: SeTakeOwnershipPrivilege	4196	powershell.exe
Token: SeLoadDriverPrivilege	4196	powershell.exe
Token: SeSystemProfilePrivilege	4196	powershell.exe
Token: SeSystemtimePrivilege	4196	powershell.exe
Token: SeProfSingleProcessPrivilege	4196	powershell.exe
Token: SeIncBasePriorityPrivilege	4196	powershell.exe
Token: SeCreatePagefilePrivilege	4196	powershell.exe
Token: SeBackupPrivilege	4196	powershell.exe
Token: SeRestorePrivilege	4196	powershell.exe
Token: SeShutdownPrivilege	4196	powershell.exe
Token: SeDebugPrivilege	4196	powershell.exe
Token: SeSystemEnvironmentPrivilege	4196	powershell.exe
Token: SeRemoteShutdownPrivilege	4196	powershell.exe
Token: SeUndockPrivilege	4196	powershell.exe
Token: SeManageVolumePrivilege	4196	powershell.exe
Token: 33	4196	powershell.exe
Token: 34	4196	powershell.exe
Token: 35	4196	powershell.exe
Token: 36	4196	powershell.exe
Token: SeIncreaseQuotaPrivilege	4484	powershell.exe
Token: SeSecurityPrivilege	4484	powershell.exe
Token: SeTakeOwnershipPrivilege	4484	powershell.exe
Token: SeLoadDriverPrivilege	4484	powershell.exe
Token: SeSystemProfilePrivilege	4484	powershell.exe
Token: SeSystemtimePrivilege	4484	powershell.exe
Token: SeProfSingleProcessPrivilege	4484	powershell.exe
Token: SeIncBasePriorityPrivilege	4484	powershell.exe
Token: SeCreatePagefilePrivilege	4484	powershell.exe
Token: SeBackupPrivilege	4484	powershell.exe
Token: SeRestorePrivilege	4484	powershell.exe
Token: SeShutdownPrivilege	4484	powershell.exe
Token: SeDebugPrivilege	4484	powershell.exe
Token: SeSystemEnvironmentPrivilege	4484	powershell.exe
Token: SeRemoteShutdownPrivilege	4484	powershell.exe
Token: SeUndockPrivilege	4484	powershell.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 3476 wrote to memory of 4728	3476	c92a6ef242d78b9083c2264519be7dcf1d104f1e391a7d36ec066a4648057077.exe	66
PID 3476 wrote to memory of 4728	3476	c92a6ef242d78b9083c2264519be7dcf1d104f1e391a7d36ec066a4648057077.exe	66
PID 3476 wrote to memory of 4728	3476	c92a6ef242d78b9083c2264519be7dcf1d104f1e391a7d36ec066a4648057077.exe	66
PID 4728 wrote to memory of 4780	4728	WScript.exe	67
PID 4728 wrote to memory of 4780	4728	WScript.exe	67
PID 4728 wrote to memory of 4780	4728	WScript.exe	67
PID 4780 wrote to memory of 1300	4780	cmd.exe	69
PID 4780 wrote to memory of 1300	4780	cmd.exe	69
PID 1300 wrote to memory of 4196	1300	DllCommonsvc.exe	91
PID 1300 wrote to memory of 4196	1300	DllCommonsvc.exe	91
PID 1300 wrote to memory of 4680	1300	DllCommonsvc.exe	90
PID 1300 wrote to memory of 4680	1300	DllCommonsvc.exe	90
PID 1300 wrote to memory of 4556	1300	DllCommonsvc.exe	88
PID 1300 wrote to memory of 4556	1300	DllCommonsvc.exe	88
PID 1300 wrote to memory of 4484	1300	DllCommonsvc.exe	86
PID 1300 wrote to memory of 4484	1300	DllCommonsvc.exe	86
PID 1300 wrote to memory of 4520	1300	DllCommonsvc.exe	84
PID 1300 wrote to memory of 4520	1300	DllCommonsvc.exe	84
PID 1300 wrote to memory of 864	1300	DllCommonsvc.exe	93
PID 1300 wrote to memory of 864	1300	DllCommonsvc.exe	93
PID 864 wrote to memory of 3640	864	cmd.exe	95
PID 864 wrote to memory of 3640	864	cmd.exe	95
PID 864 wrote to memory of 3296	864	cmd.exe	97
PID 864 wrote to memory of 3296	864	cmd.exe	97
PID 3296 wrote to memory of 584	3296	DllCommonsvc.exe	134
PID 3296 wrote to memory of 584	3296	DllCommonsvc.exe	134
PID 3296 wrote to memory of 4752	3296	DllCommonsvc.exe	135
PID 3296 wrote to memory of 4752	3296	DllCommonsvc.exe	135
PID 3296 wrote to memory of 2648	3296	DllCommonsvc.exe	136
PID 3296 wrote to memory of 2648	3296	DllCommonsvc.exe	136
PID 3296 wrote to memory of 3816	3296	DllCommonsvc.exe	138
PID 3296 wrote to memory of 3816	3296	DllCommonsvc.exe	138
PID 3296 wrote to memory of 4768	3296	DllCommonsvc.exe	140
PID 3296 wrote to memory of 4768	3296	DllCommonsvc.exe	140
PID 3296 wrote to memory of 4852	3296	DllCommonsvc.exe	142
PID 3296 wrote to memory of 4852	3296	DllCommonsvc.exe	142
PID 3296 wrote to memory of 2768	3296	DllCommonsvc.exe	144
PID 3296 wrote to memory of 2768	3296	DllCommonsvc.exe	144
PID 3296 wrote to memory of 1472	3296	DllCommonsvc.exe	146
PID 3296 wrote to memory of 1472	3296	DllCommonsvc.exe	146
PID 3296 wrote to memory of 3732	3296	DllCommonsvc.exe	148
PID 3296 wrote to memory of 3732	3296	DllCommonsvc.exe	148
PID 3296 wrote to memory of 2976	3296	DllCommonsvc.exe	150
PID 3296 wrote to memory of 2976	3296	DllCommonsvc.exe	150
PID 3296 wrote to memory of 1284	3296	DllCommonsvc.exe	151
PID 3296 wrote to memory of 1284	3296	DllCommonsvc.exe	151
PID 3296 wrote to memory of 4864	3296	DllCommonsvc.exe	154
PID 3296 wrote to memory of 4864	3296	DllCommonsvc.exe	154
PID 3296 wrote to memory of 388	3296	DllCommonsvc.exe	155
PID 3296 wrote to memory of 388	3296	DllCommonsvc.exe	155
PID 3296 wrote to memory of 940	3296	DllCommonsvc.exe	160
PID 3296 wrote to memory of 940	3296	DllCommonsvc.exe	160

C:\Users\Admin\AppData\Local\Temp\c92a6ef242d78b9083c2264519be7dcf1d104f1e391a7d36ec066a4648057077.exe
"C:\Users\Admin\AppData\Local\Temp\c92a6ef242d78b9083c2264519be7dcf1d104f1e391a7d36ec066a4648057077.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3476
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4728
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4780
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1300
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Provisioning\Cosa\OEM\smss.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4520
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Common Files\microsoft shared\fontdrvhost.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4484
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\csrss.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4556
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\RuntimeBroker.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4680
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4196
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\kc0SdEF2Lb.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:864
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:3640
      - C:\providercommon\DllCommonsvc.exe
        
        "C:\providercommon\DllCommonsvc.exe"
        6⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3296
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:584
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Web\4K\Wallpaper\Windows\explorer.exe'
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4752
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\dllhost.exe'
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2648
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Mail\csrss.exe'
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3816
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Application Data\WmiPrvSE.exe'
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4768
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\spoolsv.exe'
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4852
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\explorer.exe'
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2768
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Sidebar\Gadgets\dllhost.exe'
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1472
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\ShellExperienceHost.exe'
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3732
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\RuntimeBroker.exe'
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2976
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\fontdrvhost.exe'
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1284
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\fontdrvhost.exe'
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4864
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\csrss.exe'
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:388
        
        C:\Program Files (x86)\Windows Mail\csrss.exe
        
        "C:\Program Files (x86)\Windows Mail\csrss.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\odt\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\odt\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\odt\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\odt\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\odt\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\odt\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Program Files\Common Files\microsoft shared\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\Common Files\microsoft shared\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Program Files\Common Files\microsoft shared\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Windows\Provisioning\Cosa\OEM\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\Provisioning\Cosa\OEM\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Windows\Provisioning\Cosa\OEM\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Windows\Web\4K\Wallpaper\Windows\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Windows\Web\4K\Wallpaper\Windows\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\Web\4K\Wallpaper\Windows\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Mail\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Mail\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\Users\Default\Application Data\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Users\Default\Application Data\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 13 /tr "'C:\Users\Default\Application Data\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\odt\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\odt\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\odt\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\Default User\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ShellExperienceHostS" /sc MINUTE /mo 7 /tr "'C:\odt\ShellExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ShellExperienceHost" /sc ONLOGON /tr "'C:\odt\ShellExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ShellExperienceHostS" /sc MINUTE /mo 12 /tr "'C:\odt\ShellExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\providercommon\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\providercommon\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\providercommon\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\providercommon\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\providercommon\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\providercommon\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:420

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Web Service

T1102

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Windows Mail\csrss.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Program Files (x86)\Windows Mail\csrss.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\DllCommonsvc.exe.log

Filesize
1KB

MD5
b4268d8ae66fdd920476b97a1776bf85

SHA1
f920de54f7467f0970eccc053d3c6c8dd181d49a

SHA256
61d17affcc8d91ecb1858e710c455186f9d0ccfc4d8ae17a1145d87bc7317879

SHA512
03b6b90641837f9efb6065698602220d6c5ad263d51d7b7714747c2a3c3c618bd3d94add206b034d6fa2b8e43cbd1ac4a1741cfa1c2b1c1fc8589ae0b0c89516

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
ad5cd538ca58cb28ede39c108acb5785

SHA1
1ae910026f3dbe90ed025e9e96ead2b5399be877

SHA256
c9e6cb04d6c893458d5a7e12eb575cf97c3172f5e312b1f63a667cbbc5f0c033

SHA512
c066c5d9b276a68fa636647bb29aea05bfa2292217bc77f5324d9c1d93117772ee8277e1f7cff91ec8d6b7c05ca078f929cecfdbb09582522a9067f54740af13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
8b5f61f535b111b3d717023f4ed09935

SHA1
1781f8a4c0113d5e4769a534da8a52c150281d4c

SHA256
808b993fa97994bcb33aa57aa6ee0773f0ae4a50c0028160703046d3cfbbeabe

SHA512
a1d2ea38149aeecbce577bb19c7447da201dfbfbee64a36214900628ba73135f6413ccbb9438fc2e5d0ede86a0c7ea1d817033b27fd52fc4d2e9366465e94bee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
43e5b7f4fde44680bee64d186cb1e81a

SHA1
e44041400b8043408a79e96e14978c734b5d059e

SHA256
09ab5f942a87f33ae17443241143bc0c1a0c876bf9ad3d8be1021a10ee51daf5

SHA512
a6e41534b2a1a62e7f3802a86956c6dd2655c74b7750bd04b86ab92b763c624de54fc5203ecde39c368c3332c72d199e2be70139826520c7c216dc8cce44d9d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
43e5b7f4fde44680bee64d186cb1e81a

SHA1
e44041400b8043408a79e96e14978c734b5d059e

SHA256
09ab5f942a87f33ae17443241143bc0c1a0c876bf9ad3d8be1021a10ee51daf5

SHA512
a6e41534b2a1a62e7f3802a86956c6dd2655c74b7750bd04b86ab92b763c624de54fc5203ecde39c368c3332c72d199e2be70139826520c7c216dc8cce44d9d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
43e5b7f4fde44680bee64d186cb1e81a

SHA1
e44041400b8043408a79e96e14978c734b5d059e

SHA256
09ab5f942a87f33ae17443241143bc0c1a0c876bf9ad3d8be1021a10ee51daf5

SHA512
a6e41534b2a1a62e7f3802a86956c6dd2655c74b7750bd04b86ab92b763c624de54fc5203ecde39c368c3332c72d199e2be70139826520c7c216dc8cce44d9d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
43e5b7f4fde44680bee64d186cb1e81a

SHA1
e44041400b8043408a79e96e14978c734b5d059e

SHA256
09ab5f942a87f33ae17443241143bc0c1a0c876bf9ad3d8be1021a10ee51daf5

SHA512
a6e41534b2a1a62e7f3802a86956c6dd2655c74b7750bd04b86ab92b763c624de54fc5203ecde39c368c3332c72d199e2be70139826520c7c216dc8cce44d9d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
ede548d9d09695daf47578a06e8a3ce2

SHA1
23759177270341fd3f78e93a9594d967be083245

SHA256
bdb65d936dabc1615a54f13bada8ae5bb9774ff4182b8c0c8589718b23103842

SHA512
06b851ccb51de1d4c35bf865085381a6b023a8a538ed36b69e122880fc9d933b1e4dada08c3df2aef09b56ce5266f88a692a37f3a7aa4698b6ef2722f3adb8f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
19f14728c2bc604dfb1b0135b7b5d629

SHA1
00d939e52552a24af9104259da67ac71b215a0ae

SHA256
e082b0da1db6473cfdc9d7d02ba3b9414d175afdab32a3ed9c5a576f90c7cf87

SHA512
41c8f6cbf812f01d3a83b33a8656fdaf2e57b7a5183f405d146a5e5f67b6d412a2df912570059d03d67d13e38d6c7b26850d7b5cdd52d6fe36ae48dae54b649a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
c055fe9a91aaf63cc0a26ad651fd88bc

SHA1
76e6af07cce236a2027aae1df2531120a20d2066

SHA256
b7cdf0654f7ed86d991ae2bb62118ddf7281b79c918773992436cddeb5e7ad73

SHA512
51ce5f4de07e4c39bb6cb139b44ed9205c244124b6675b388fa7083e0e98be5056a2488397252919ab9fcdc63b1953e7d02c1f58ef40c628af5871dde4e767f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
c055fe9a91aaf63cc0a26ad651fd88bc

SHA1
76e6af07cce236a2027aae1df2531120a20d2066

SHA256
b7cdf0654f7ed86d991ae2bb62118ddf7281b79c918773992436cddeb5e7ad73

SHA512
51ce5f4de07e4c39bb6cb139b44ed9205c244124b6675b388fa7083e0e98be5056a2488397252919ab9fcdc63b1953e7d02c1f58ef40c628af5871dde4e767f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
65f76f39cf53dae6abbc6b844e8704a0

SHA1
1566d7f1e256d8939e2c05d71ddc0bb3aa6e9a31

SHA256
eba780932cf2d8f8f611396a298855a79aa35348b1b0a433b035b909b54f1db9

SHA512
5bbae8f288b104ebcdec9328ad105a52cf5f5a390c6ac794311b4757af37fa3b699772c57b03c099f30f33cf93ad3633303a666a43fe40920f7130730afb41f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
c055fe9a91aaf63cc0a26ad651fd88bc

SHA1
76e6af07cce236a2027aae1df2531120a20d2066

SHA256
b7cdf0654f7ed86d991ae2bb62118ddf7281b79c918773992436cddeb5e7ad73

SHA512
51ce5f4de07e4c39bb6cb139b44ed9205c244124b6675b388fa7083e0e98be5056a2488397252919ab9fcdc63b1953e7d02c1f58ef40c628af5871dde4e767f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
c055fe9a91aaf63cc0a26ad651fd88bc

SHA1
76e6af07cce236a2027aae1df2531120a20d2066

SHA256
b7cdf0654f7ed86d991ae2bb62118ddf7281b79c918773992436cddeb5e7ad73

SHA512
51ce5f4de07e4c39bb6cb139b44ed9205c244124b6675b388fa7083e0e98be5056a2488397252919ab9fcdc63b1953e7d02c1f58ef40c628af5871dde4e767f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
c982551a51d44ae5c44332fbbde5be25

SHA1
33ca4d21fb1a52ca4e0db39bac79ffc109e2a284

SHA256
26a82b928ddef2d71f55dcb457c084d43619861e6018de68e8ba8c132949c61b

SHA512
147e46c008d8cca957bbb86b9809952e937c269f9106587fd77fc5f8ecd6672aa20729d4ca5b29ac032507f6837cea48e39c731572a7395cf9f86485cc05b852

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
1e57a6cb857b525e6125cda7c1bd9b6a

SHA1
cb72b9f6772230b8a18fdea7cba7d3cc61e1c2cf

SHA256
af8018062e089bb70ba7fdfd9d7982d9192f0eade158082530175f77794dc434

SHA512
b3a3427a869cee771a8bb52b62dbe9a7b233aa2e94aed8a5dbb33905200d87d84ca11a814ae0595dc820253d210f9416d7b440ee91be742c5a524b9ede2de226

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
1e57a6cb857b525e6125cda7c1bd9b6a

SHA1
cb72b9f6772230b8a18fdea7cba7d3cc61e1c2cf

SHA256
af8018062e089bb70ba7fdfd9d7982d9192f0eade158082530175f77794dc434

SHA512
b3a3427a869cee771a8bb52b62dbe9a7b233aa2e94aed8a5dbb33905200d87d84ca11a814ae0595dc820253d210f9416d7b440ee91be742c5a524b9ede2de226

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
4c87ccd2fd487916f9178bbd4cd44be3

SHA1
4686fb389e4eb6d1c2a5d893471be81bd1ab79e0

SHA256
71c40e8eb7e4228cf4e593e13b7fadf4fdae2c7b3a8141198c0d4000a78c8d65

SHA512
d53d79a7829d9849d3ff4b239b0f211d00ad6831b9f7cfd8d19a9134c9423d354a6ebd504ab179b563e6cfa7bd1c2c69009d144e17ab2e9747889e54c4deb560

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
d8fbf0e6ad86895d48504785c2bef06e

SHA1
638a44bac2df1167b701e818e75e781cac7321ec

SHA256
6e7fd2a5d4fe3bdc394657f879407e921221f94a96fba453fac2fc844a43e0fd

SHA512
99e8422b1f00087db10a4793ee2e6237eb4f2003c94ae3cc0577686a3453c6562e067ad302337cb9aa0d61e985e9dc93494222f3e5cba0cb541e8236968262d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\kc0SdEF2Lb.bat

Filesize
199B

MD5
dfd478d38422117587aadb2d7ff3c261

SHA1
72de0b65d6f1f5e73a56ce52b943bba09548f8d5

SHA256
c87de8f1177d5ac383a22c1d2497cbf18be97ae2d475939c63788eac49905c24

SHA512
5c37129ea23cce476d13d25883cfb34d17194031779db62085dd11dd082d722833b7593b5221b93861c85c724ed99da27ec5d61055a048e5d6cefdcb9f3bf627

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/940-554-0x0000000001060000-0x0000000001072000-memory.dmp

Filesize
72KB

Download
memory/1300-289-0x000000001B5D0000-0x000000001B5DC000-memory.dmp

Filesize
48KB

Download
memory/1300-288-0x0000000002CA0000-0x0000000002CAC000-memory.dmp

Filesize
48KB

Download
memory/1300-287-0x0000000002C90000-0x0000000002C9C000-memory.dmp

Filesize
48KB

Download
memory/1300-286-0x0000000002B30000-0x0000000002B42000-memory.dmp

Filesize
72KB

Download
memory/1300-285-0x0000000000A60000-0x0000000000B70000-memory.dmp

Filesize
1.1MB

Download
memory/3296-483-0x0000000001370000-0x0000000001382000-memory.dmp

Filesize
72KB

Download
memory/3476-154-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/3476-142-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/3476-168-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/3476-169-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/3476-170-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/3476-171-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/3476-172-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/3476-173-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/3476-174-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/3476-175-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/3476-176-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/3476-177-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/3476-178-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/3476-179-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/3476-180-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/3476-181-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/3476-182-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/3476-120-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/3476-121-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/3476-122-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/3476-166-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/3476-165-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/3476-124-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/3476-164-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/3476-163-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/3476-162-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/3476-161-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/3476-160-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/3476-159-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/3476-158-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/3476-157-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/3476-125-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/3476-127-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/3476-128-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/3476-129-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/3476-130-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/3476-156-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/3476-131-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/3476-132-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/3476-155-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/3476-133-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/3476-144-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/3476-151-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/3476-119-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/3476-153-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/3476-152-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/3476-150-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/3476-149-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/3476-148-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/3476-147-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/3476-146-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/3476-134-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/3476-145-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/3476-135-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/3476-136-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/3476-137-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/3476-143-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/3476-139-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/3476-141-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/3476-167-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/3476-138-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/3476-140-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/4680-316-0x00000241BDAF0000-0x00000241BDB12000-memory.dmp

Filesize
136KB

Download
memory/4680-324-0x00000241BDBD0000-0x00000241BDC46000-memory.dmp

Filesize
472KB

Download
memory/4728-185-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/4728-184-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download